July 2006

“As I said earlier this is Jennifer from Beateval.” Mark said to his helpdesk staff. n3m0 checked his watch. 2:55 PM, I think I’ll have an executive lunch hour tomorrow. Looking around at the other drones in helpdesk, they all seemed to be smiling at Jennifer. n3m0 couldn’t really blame the other guys; she looked fabulous. But when they were feeling anticipation, n3m0 was closer to hostility.

When she started to speak her words never registered in n3m0’s mind, instead he found himself traveling to Middle Earth.

There was a long silence. At last Frodo spoke with hesitation. “I believed that you were a friend before the letter came,” he said, “or at least I wished to. You have frightened me several times tonight, but never in the way that servants of the Enemy would, or so I imagine. I think one of his spies would - well, seem fairer and feel fouler, if you understand.”
Jennifer is fair but feels foul, n3m0 found himself agreeing with Frodo’s wisdom.
“I see,” laughed Strider. “I look foul and feel fair. Is that it? All that is gold does not glitter, not all those that wander are lost.”
“Did the verses apply to you then?” asked Frodo. “I could not make out what they were about. But how did you know that they were in Gandalf’s letter, if you have never seen it?”
“I did not know,” he answered. “But I am Aragorn, and the verses most definitely were not about Jennifer.” Sam said nothing.

As Jennifer stopped talking, n3m0’s consciousness returned to the office. Seeing her with new eyes he thought dreamingly, my precious.

“Let’s save the questions for later,” Mark interrupted the explosion in the room. “As Ms. Hartpence was saying her company is one that specializes in call center services just like this helpdesk department.”
“We are going to outsource helpdesk to Beateval, for most of you that will mean you’ll have closer to work.”

n3m0 almost laughed. Remembering the visiting address from Beateval’s website he knew he would be adding at least half an hours travel in each direction.

Well isn’t this ironic, I start working in this dump in order to climb a ladder which is knocked down by those above and now sold by the man in charge. n3m0’s eyes found Jennifer’s cleavage, I wonder if this was a financial decision.

n3m0 was having trouble staying focused on the discussion and he missed Simon’s question.
“To be frank, it’s my fault,” Mark answered, “lately I haven’t had time to involve myself in helpdesk.”
I think what you’re trying to say is that you haven’t cared enough.
“And I know that Jennifer will out perform me any day, besides I’ve heard they have just as good dental care as we do.”
The group chuckled.
“No Mark, that’s actually wrong. Ours is much better!” Jennifer showed off her perfect white teeth.
The group laughed.

The meeting went on for an hour; Jennifer seemed to be charming the lot of them. n3m0 on the other hand was feeling weak. At the end of the meeting he could see an imagined BSD demon jumping up and down on his shoulders. Over and over it was screaming “Division by zero, division by zero!”

Tags: security, stories, fiction, insider threat

“Simon isn’t here,” Thomas informed them, “he’s at the dentist this morning.”
“The dentist” Mark was clearly disappointed, “so when will he be back?”
Thomas checked the Outlook calendar. “He’s coming after lunch.”
“Can you stay until then?” Mark asked Jennifer.
“Sure, that’s no problem.”
“Okay, great,” he turned to his staff. “We’ll be back after lunch. Make sure everyone, including Simon, are here.”

Whey they left, the cubicle farm came alive with chatter. n3m0 never spoke much during these types of events, instead he tried to listen and make sense of the information.

It turned out that no one had a clue that Mark and Jennifer had been sitting in meetings. n3m0 sighed, well isn’t that bloody strange, we never know what that guy is up to.

“She kind of remind me of someone famous.” n3m0 didn’t hear who said it but knew it was Thomas.
“Yeah, doesn’t she?” Jack agreed.
Is this really relevant? n3m0 shook his head.
“I think she might have appeared in a movie,” Thomas continued “but I’m not positive.”
“You know what, someone should Google her ass.” Jack laughed.
n3m0 had had enough, trying his best to sound like a fairy princess he said, “yes why don’t we Google her fine ass, lets just hope no one else is called Jennifer. Hell with such a pretty face she might have a page rank of nine.”
“We never got her last name, did we?” Thomas sounded disappointed.

However stupid n3m0 thought it was at first, it gave him an idea. He opened up Firefox and typed, [Ctrl]+K, Beateval Services, [Enter]. The Google results presented him with Beateval’s home page.

He found a picture of Jennifer among the executives. Her full name was Jennifer Hartpence. The thought of sharing the information with the others never crossed n3m0’s mind, he didn’t see how he could profit by telling his coworkers. n3m0 liked the term “need to know basis”, as long as it didn’t apply to him.

He clicked on the about link which described the company. When he was done he continued to read about their services, their customers, their news archive. He went back to the search page and checked the other results for Beateval.

All in all he did not like his findings.

Tags: security, stories, fiction, insider threat

Some people equate their work with their life. They are passionate about that they do for a living. Before they fall asleep at night they think about their jobs, when they wake up in the morning they are already thinking about how to solve a problem. At night they dream about completing their current project, just so they can start tackling the next one. None of this however would correctly describe the way n3m0 felt about his work.

He hated what he was doing to bring in the cash and despised his coworkers. The last eighteen months n3m0 had been working in the help desk department at Exibice Logistics. The single reason he had taken the job was that someone in a newsgroup had recommended that he take a low paid entry job, learn all he could from those above him and work his way up. The problem was that the server and network guys didn’t want anything to do with the help desk staff.

Instead n3m0 was stuck with “buddies” like Thomas. When n3m0 thought of Thomas his brain translated his name to Ned Flanders. Working at Exibice had if anything made it a pain to watch the Simpsons. If at all possible he would rather have had bonsai buddy as a colleague.

It was Monday, and as usual Thomas was there before n3m0.
“Did you hear about the guy with the red paperclip, that he traded for a house?” Thomas asked.
Of course, n3m0 thought, that’s last week’s news.
“Yeah, I read about it.”
“Can’t do much but congratulate the man, can you?”
“Congratulate, no” n3m0 muttered, “you can’t”. When he had read about it he had been absolutely pissed. Why can’t I come up with an idea like that? n3m0 had been thinking hard after that but an idea never entered his mind.

The login scripts seemed to take for ages. What the hell are those guys doing? n3m0 dismissed the idea of checking the netlogon share, he wasn’t that interested. When his email finally loaded he could hear Thomas’ voice on the phone.
“Imagine, for just one red paper clip. I sure wonder what I could get for a blue one,” and then laughter which would make angels cry or at least kill off small animals. “Or a green one,” more laughter. “Pink!” n3m0 could see Thomas drying the tears from his eyes.

Dear god, spare me. n3m0 wished he had a hearing aid so he could turn it off. After ten minutes he was free of the painful experience and could in peace go through his inbox.

Later on when n3m0 looked up from his screen he saw an absolutely beautiful woman smiling at him. His heart leaped, he was about to smile back but she broke the eye contact and watched the others in the help desk department. Then n3m0 realized she was there with Mark Archer, the CTO of Exibice Logistics.

“Hello everybody, this is Jennifer from Beateval Services.”
“Hi, guys,” Jennifer said with a growing smile to the group.
“Hi, Jennifer” n3m0 found himself saying together with the rest of them.
“As you probably know, myself and Jennifer have been meeting a few times and have come to an understanding.”
Jennifer stepped in. “We’d like to inform you all about our plans.”

Tags: security, stories, fiction, insider threat

After running this blog for a few months I thought it was time to give midfr0st and n3m0 a new home. So the old default Wordpress theme is gone. If you’re reading this through feed take a look at the new site.

I like the new version more and I hope you do to. I have also added some more information about myself and the site in general.

Another addition is the story section where I will list past stories as well as current and upcoming ones.

Soon I will also add a page for the characters where you can get to know them better, and have something to read while I’m being slow.

For SYDI fans I have a few tutorials / how-to articles I’ve been thinking about. If you want anything specific just ask me. However at the moment I’m more interested in getting out part one of the next story.

Oh, if you’re reading through feed you might notice that several posts appear as updated. I’ve been playing around with the options at FeedBurner. Sorry for the inconvenience.

Tags: redesign, reloaded

Friday 10:22 AM, at Meriabeck.

cbrooks: Thank God it’s Friday!
Haven: No shit, I can’t wait to get out of here
cbrooks: Got any plans for later?
Haven: Yeah, Fred was talking about barbecuing want to join us for a few beers and perhaps a game of Risk?
cbrooks: Sounds great!
Haven: Nice, so what’s up?
cbrooks: Not much, I have to check the backup tapes, but things seem to be quite slow today.
Haven: Man, I hate that! It’s boring to no end.
cbrooks: Well it’s nice enough on some days, I might start doing the reporting for WSUS if nothing comes up.
Connection timed out

“Hi Christopher, Jake’s printer doesn’t work and he wants it fixed asap.” Mary was Jake Gordon’s assistant and Jake usually sent her running to Christopher Brooks, the sys admin at Meriabeck, whenever something on the network didn’t work.
“His printer?” Christopher sounded very confused, “I thought it was the sales department’s printer.”
Mary smiled, “well he wants it fixed yesterday”.
“But it was working yesterday, why didn’t he print the document then?” Christopher joked, opening up Firefox and typing in http://p-ljc-sales/.

Server not found

He opened a shell instead:

ping p-ljc-sales.lan.meriabeck.com [enter]

Unknown host p-ljc-sales.lan.meriabeck.com

Connection timed out, Christopher got an uneasy feeling when he thought about his irc session timing out.

Kathy Delgado walked into his office and blurted out. “Chris I’m unable to send emails, and the phones don’t work”.
“Hang on,” Christopher said typing commands:

nslookup [enter]

The current directory is invalid.

c: [enter]
nslookup [enter]

*** Default servers are not available
Default Server: UnKnown
Address: 127.0.0.1

“Did you say the phones didn’t work?” Christopher turned his attention to Kathy.
“Yep, both of them died when I was talking. When can you get the mail working?”
“Were you talking on both your phones at the same time?,” Mary asked with a laugh.

Christopher wasn’t listening any more, he was running to the server room.

Inside the server room several of the servers had blue screened, others where shutting down. Within minutes there were a crowd of people in the server room, all of them wondering when everything would be back to normal, some of them were screaming.

What Christopher got most annoyed with were the ones trying to help or guess what had happened.

When someone asked, “have you checked the UPS’?” he almost cried. The best thing that happened during the morning was when Mary brought him a cup of coffee. As always the coffee at work tasted like a bad joke but right now it was sorely needed.

After bringing the first server back to life Christopher managed to relax a bit. He meant to phone Haven, or Sean as he was called in real life, to tell him that he wouldn’t be coming to the barbeque tonight. Sean was also a sys admin and his help could be useful. His mobile phone had been reset, for a moment he considered activating it but dropped that idea as he realized he didn’t have Sean’s number in his head. Since he got his first cell phone he had stopped remembering numbers.

What is going on?, he thought. The victorious feeling from bringing back the server had faded when he saw his cell phone and was utterly crushed when he heard a scream in the office.

Christopher hardly ever saw Michel Bordeleau, the CEO of Meriabeck, but today when he walked into the server room the executive looked like a ghost.

“We have some serious trouble.” Michel said.
“I know,” Christopher started, “I’m working on getting everything back up.”
“Don’t touch anything, it will be needed as evidence.”
“Sir?” the sys admin said uneasily.
“What we need now is access to the Internet and a phone.”
“But the firewall is toast.”
“I don’t care. I just have to get online with my laptop. Ms. Delgado will also need to be connected.”
“We have an old D-link router I think we could connect.”
“Great,” Michel gave his cell phone to Christopher, “and can you fix this, I need to make a call.”
“Sure, but you won’t have access to your contacts.”
“That’s not a problem. I have them cached in Outlook. Remember, don’t touch anything.”

After setting Michel and Kathy up with an Internet access, Christopher opened Outlook on his workstation and grabbed Sean’s number.

Sean was all excited when he called, and congratulated Christopher and the people at Meriabeck. At first Christopher hadn’t a clue of what his friend was talking about. After a few minutes Christopher realized why his CEO had looked like a ghost.

Aftermath

The following Monday there were some talk about the stock holders suing the executive officers at Meriabeck for failing to protect the company’s network and good name.

During a press conference on Monday afternoon Kathy Delgado explained to the public what had happened and that Meriabeck would do all that it could to help the authorities to catch the responsible hacker.

A week after the event the stocks had stabilized at 5% under what it was sold for the previous week.

After that week Christopher felt like he had never needed a vacation as bad as he did now.

Please note this is a purely fictional story, any names found here are made up. I’ve written this because I like writing, if someone reads it and enjoy it: great. If they get more conscious about security, that’s a bonus. If you have feedback or comments on the story please share them.

Links of Interest:

Cognitive Hacking and the Value of Information

Emulex Fraud Hurts All

The Art of Deception

Tags: security, stories, fiction

midfr0st had just finished his breakfast. His fridge was empty so he had gone out to a nearby café and was lighting a cigarette as his laptop was booting. Thanks to his digital hotspotter midfr0st had been sure he would have wireless access at the café, he chose a wep “protected” wlan to connect through. The wep key lasted 226 seconds.

The stock market had just opened. midfr0st stretched his legs and cracked his knuckles. He began by changing the passwords for Meriabeck’s CMS system, unless they knew about the sql injection they wouldn’t be able to edit their website. They could probably still access it through ftp if they could locate their account details, the other option they had was phoning the web hotel and have them shut down the site. midfr0st’s gut told him that even if they had their ftp credentials they would be unable to change the site without access to the CMS system.

midfr0st: Are you ready?
c@rri3r: sure man!
midfr0st: excellent, take it down
c@rri3r: now?
midfr0st: now

midfr0st wiped all the mobile phones he could see in the Mobile Administration Web Tool, for at least a few hours Meriabeck would have trouble receiving any telephone calls.

Looks great, midfr0st thought as he saw his piece on Meriabecks website. He sent out a press release from Kathy R. Delgado, the PR woman at Meriabeck. midfr0st considered sending out an informative email to all the employees to add to the confusion, but decided it would be better if the company didn’t know what was happening. Before he left Meriabeck to its fate he shut down the network and killed the firewall.

“What’s so funny?” the waitress asked with a smile on her face. midfr0st just looked at her, not sure what to do, he held up his empty cup.
“Not enough coffee, I get all strange and giggly if I’m below my quota.”
She laughed and poured him another cup, when she went away she smiled almost sadly at him.

After finishing his coffee midfr0st walked home. Having some time to kill he logged into bloglines to read up on his feeds. Just after reading a few entries his phone began to buzz.

Text message received: “Meriabeck Stock Rising”

midfr0st logged into his bank and sold all the stocks he had at a 18% gain, he heard later that tr0y had sold the stocks he bought at a 24% profit.

A few hours later the stock exchange closed the trading for Meriabeck when they had dropped 45% for the day.

What comes up must go down, midfr0st thought, inhaling smoke from his newly lit cigarette.

Tags: security, stories, fiction

Since midfr0st saw the established inbound connection he had been awake for eighteen hours. His documentation of Meriabeck’s network was as complete as he needed it to be. He had been very happy when he saw they were running Exchange and had Remote Wipe set up.

To complete his goals midfr0st had been forced to involve another hacker, a pbx guy with the handle c@rri3r. VoIP he could handle but midfr0st didn’t want anything to do with what he thought was the old school - the noise from his old modem still haunted him. Sooo slow, he thought. Midfr0st didn’t want to have anything to do with c@rri3r but the job had to be done and the pbx hacker was happy to do it for $2000.

midfr0st had just finished writing the press release that Meriabeck was going to release. He realized that the deadline was two weeks away but he already had everything he needed to set it in motion.

It was 8:25 PM, Thursday. I’ll drop the bomb tomorrow, midfr0st though while switching off his screen, time for some coffee.

Walking to a nearby coffee shop midfr0st thought about what would happen tomorrow. He was going to issue a press release to some selected financial magazines stating that Meriabeck had received an enormous order and a service contract for the coming five years from Tamaka Industries, a huge company located in Singapore.

The fourteen hours time difference would mean that the head office in Singapore would be closed and unable to confirm or deny the press release.

midfr0st had also written a piece he would add to the Meriabeck public web page to add to the spice. Although he didn’t consider himself much of an artist, midfr0st was quite proud of the image he had merged from two photographs where the CEO of Meriabeck was shaking hands with the CTO of Tamaka Industries.

Since midfr0st knew the photo was a fake he could spot the rough edges very quickly, but for others not expecting a forged picture on meriabeck.com it would pass scrutiny for at least a few hours.

A few hours is all I need, midfr0st thought and took a sip of his fresh cappuccino.

Tags: security, stories, fiction

Less than a week after SYDI-Server 2.0 was released a guy named Red Erik sends me an Italian language file, so now SYDI-Server has language files for English, Swedish and Italian.

If you want your native language to be supported just take a look at the language xml files and give it a try. All you need is notepad!

I will include the Italian language file in the next version of SYDI. For now I’ve uploaded it to the patch section, so you can find it here.
Thank you Red Erik!

Tags: sydi, network documentation, italian, translation, software, inventory